Description
In PrestaShop contactform module (prestashop/contactform) before version 4.3.0, an attacker is able to inject JavaScript while using the contact form. The `message` field was incorrectly unescaped, possibly allowing attackers to execute arbitrary JavaScript in a victim's browser.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PrestaShop | contactform | < 4.3.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | prestashop/contactform | >= 1.0.1, < 4.3.0 | 4.3.0 | GHSA-95hx-62rh-gg96 |